import { env, exports } from "cloudflare:workers";
import { beforeAll, describe, expect, it } from "vitest";

import { makeAuth } from "@/worker/auth";

import { ISSUER, signInForCookie, testHeaders } from "./helpers";

const SELF = exports.default;

// Cache headers protect authenticated payloads (admin lists, account
// data, secret-bearing responses) from intermediary or shared-cache
// retention. Public OIDC documents are cacheable; other dynamic worker
// responses get a baseline `Cache-Control: no-store, private` + `Vary:
// Cookie`. Secret-bearing responses (invite create, OAuth client
// create/rotate) carry the stricter `no-store, private, max-age=0`
// directly.
describe("Cache and Vary headers", () => {
  const adminCred = {
    email: "headers-cache-admin@example.com",
    password: "correct-horse-battery-staple",
    name: "Cache Headers Admin",
  };
  let adminCookie: string;

  beforeAll(async () => {
    const auth = makeAuth(env, { baseURL: ISSUER, issuer: ISSUER });
    await auth.api.signUpEmail({ body: adminCred, asResponse: false });
    await env.DB.prepare("UPDATE users SET role = ? WHERE email = ?").bind("admin", adminCred.email).run();
    adminCookie = await signInForCookie(adminCred.email, adminCred.password, "10.74.0.1");
  });

  it("emits Cache-Control: no-store, private and Vary: Cookie on authenticated GET", async () => {
    const res = await SELF.fetch(`${ISSUER}/api/admin/clients`, { headers: { cookie: adminCookie } });
    expect(res.status).toBe(200);
    expect(res.headers.get("cache-control")).toBe("no-store, private");
    expect(res.headers.get("vary")).toBe("Cookie");
  });

  it("emits Cache-Control: no-store, private on unauthenticated public route", async () => {
    // /api/config is public but still goes through the worker — the
    // middleware-set defaults must apply there too so a misconfigured
    // proxy does not cache config drift across users.
    const res = await SELF.fetch(`${ISSUER}/api/config`);
    expect(res.status).toBe(200);
    expect(res.headers.get("cache-control")).toBe("no-store, private");
    expect(res.headers.get("vary")).toBe("Cookie");
  });

  it("emits public cache headers without Vary: Cookie on JWKS", async () => {
    const res = await SELF.fetch(`${ISSUER}/api/auth/jwks`);
    expect(res.status).toBe(200);
    expect(res.headers.get("cache-control")).toBe("public, max-age=300, stale-while-revalidate=600");
    expect(res.headers.get("vary")).toBeNull();
  });

  it("does not add Vary: Cookie to OIDC discovery metadata", async () => {
    const res = await SELF.fetch(`${ISSUER}/.well-known/openid-configuration`);
    expect(res.status).toBe(200);
    expect(res.headers.get("cache-control")).toMatch(/^public, /);
    expect(res.headers.get("vary")).toBeNull();
  });

  it("emits Cache-Control: no-store, private, max-age=0 on secret-bearing OAuth client create", async () => {
    const res = await SELF.fetch(`${ISSUER}/api/admin/clients`, {
      method: "POST",
      headers: testHeaders({ cookie: adminCookie }),
      body: JSON.stringify({
        name: "headers-cache-fixture",
        redirectUris: ["http://127.0.0.1:0/cb"],
      }),
    });
    expect(res.status).toBe(201);
    expect(res.headers.get("cache-control")).toBe("no-store, private, max-age=0");
  });
});